Reporting API in Drupal konfigurieren

<?php
// modules/custom/security_headers/src/EventSubscriber/ReportingSubscriber.php

namespace Drupal\security_headers\EventSubscriber;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\ResponseEvent;
use Symfony\Component\HttpKernel\KernelEvents;

class ReportingSubscriber implements EventSubscriberInterface {

  public static function getSubscribedEvents() {
    return [KernelEvents::RESPONSE => ['onResponse', 0]];
  }

  public function onResponse(ResponseEvent $event) {
    $response = $event->getResponse();

    // Reporting-Endpoints (neue API)
    $response->headers->set('Reporting-Endpoints',
      'default="https://ihre-domain.de/api/reports"');

    // Report-To (ältere API, Fallback)
    $reportTo = json_encode([
      'group' => 'default',
      'max_age' => 86400,
      'endpoints' => [
        ['url' => 'https://ihre-domain.de/api/reports']
      ]
    ]);
    $response->headers->set('Report-To', $reportTo);
  }
}